CVE-2021-33912

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220bThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00015.htmlMailing List, Third Party Advisory
https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosureExploit, Third Party Advisory
https://security.gentoo.org/glsa/202401-22
https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220bThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00015.htmlMailing List, Third Party Advisory
https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosureExploit, Third Party Advisory
https://security.gentoo.org/glsa/202401-22

Timeline

Published: Jan 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-339139.8libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e CVE-2021-33923.2A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an err CVE-2021-339235.5Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive informa CVE-2021-339249.8Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component t CVE-2021-339259.8SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows una CVE-2021-339268.8An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5 CVE-2021-339287.5Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Serv CVE-2021-339297.5Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial o CVE-2021-33934.3An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but CVE-2021-339307.5Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a D CVE-2021-339387.5Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial o CVE-2021-33948.8Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a